CVE Vulnerabilities

CVE-2012-2666

Insecure Temporary File

Published: Jul 09, 2021 | Modified: Oct 18, 2021
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script.

Weakness

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Affected Software

Name Vendor Start Version End Version
Go Golang 1.0.2 1.0.2
Golang Ubuntu trusty *
Golang Ubuntu upstream *
Golang-1.10 Ubuntu trusty *
Golang-1.16 Ubuntu trusty *
Golang-1.16 Ubuntu xenial *
Golang-1.6 Ubuntu trusty *

References